chore(repo): publish-readiness sanitization sweep (LC-521) #514

Merged

nrupard merged 2 commits from chore/LC-521-publish-sanitization into main 2026-07-06 21:44:29 +02:00

Conversation 0 Commits 2 Files changed 72 +78 -32051

nrupard commented 2026-07-06 21:30:19 +02:00

Owner

Copy link

Working-tree sanitization so the lets-chat repo is safe to publish publicly (subtask of LC-518). HEAD only; the git-history rewrite for the two secrets already committed is the separate LC-522 follow-up. Internal material is relocated into a new git-ignored internal/ (kept for the team), not destroyed.

A. Docs relocate + redact

• New git-ignored internal/ holds the relocated docs/audit/ (whole-codebase audit report with exploit recipes), docs/superpowers/ (48 build-history plans/specs), and CLAUDE.md. FUTURE.md deleted. docs/ now keeps only the 7 public how-to docs.
• Redacted in place: README dev-only Docker+Traefik block relocated to internal/dev-web-traefik.md (kept the just dev-web-local flow); CHANGELOG internal registry host genericized; ui-conventions.md LC-148 audit finding-ID back-refs dropped (rationale kept); protocol-bridges / email-ingress / desktop-update-signing internal LC-* / #PR issue refs genericized (design rationale kept); oidc/client.rs dev-cert comment de-hosted.
• Bonus doc-bug fix: protocol-bridges.md claimed the avatar-proxy 400 returns an LC-78-AVATAR-PROXY token in the error body. The real body names LETS_CHAT_BRIDGE_AVATAR_PROXY_ENABLED (verified against routes/api.rs); doc now matches code.

B. Secret scan config

• Pruned the dead Docker-inherited excludes (.sops.yaml, *-secrets.yml, archived/ - none exist here) from .trufflehog-exclude.txt, .noseyparker-ignore.txt, and the kingfisher inline excludes in check-secrets.yml. Kept the LC-471 favicon base64 false-positive excludes.
• Untracked the force-tracked .claude/settings.local.json (scheduled_tasks.lock was already untracked).
• The two real dev secrets (LETS_CHAT_SECRET_KEY, LETS_CHAT_BUNYIP_SSO_CLIENT_SECRET) leave the tree with the relocated compose files. They persist in history: rotate + purge under LC-522.

C. Compose consolidation

• Kept compose.yml + the 3 localhost dev files (dev-web-local, dev-web-local-saas, dev-desktop). Relocated compose.dev-web.yml, compose.dev-web-saas.yml, and the orphan compose.dev.yml.1 (plus the now-unused dev/traefik-ip helper) into internal/.
• justfile: dropped the dev-web / dev-web-saas recipes (+ their -down/-clean), removed them from dev-clean, and added a run / run-down recipe for the production-shape compose.yml.

D. Infra genericize (user-visible)

• desktop/tauri.conf.json publisher/homepage/copyright and server/package.json repo URL de-hosted to placeholders; .env.saas commented app.a8n.run example URLs -> example.com.

Decisions confirmed before implementing

• desktop/src/update.rs DEFAULT_UPDATE_URL left as-is. It is read at runtime and is the functional a8n-tools update endpoint; genericizing it would silently break desktop auto-update. The README default cell is kept consistent with it. The host also remains in the CI-plumbing refs (below) that were explicitly kept.
• .env.standalone / .env.saas kept tracked as the de-facto env reference (no .env.example exists), with their contradictory .gitignore lines removed. Content is placeholder-only.

Verification

• just check, just test, just test-saas all green.
• just dev-web-local still resolves; new just run builds compose.yml.
• grep -rn 'a8n.run' $(git ls-files) shows only the intended CI-plumbing hits (build-oci-image.yml REGISTRY_PROVIDER, Dockerfile.web image.source LABEL, justfile fj --host + release-URL rewrite) plus the deliberately-kept LETS_CHAT_UPDATE_URL default in README + update.rs.
• Secret scanners are not installed in this environment; PR CI (check-secrets.yml) runs them. Commands, for reference:
  • trufflehog filesystem --no-update --fail --only-verified --exclude-paths .trufflehog-exclude.txt .
  • noseyparker scan -i .noseyparker-ignore.txt . && noseyparker report
  • kingfisher scan --git-history full <favicon excludes> .

Notes / heads-up

• Relocating CLAUDE.md out of the tree means Claude Code sessions on the published repo no longer auto-load it; the team keeps internal/CLAUDE.md.
• The internal/ dir is git-ignored, so nothing under it is in this diff; it exists on the working tree for the team.
• Not operator-visible (no env var / config-format / API-contract / shipped-security change): no [operator-action] marker. The removed recipes are developer-workflow only; production compose.yml is unchanged.

#LC-521

Working-tree sanitization so the `lets-chat` repo is safe to publish publicly (subtask of LC-518). HEAD only; the git-history rewrite for the two secrets already committed is the separate **LC-522** follow-up. Internal material is relocated into a new git-ignored `internal/` (kept for the team), not destroyed. ## A. Docs relocate + redact - New git-ignored `internal/` holds the relocated `docs/audit/` (whole-codebase audit report with exploit recipes), `docs/superpowers/` (48 build-history plans/specs), and `CLAUDE.md`. `FUTURE.md` deleted. `docs/` now keeps only the 7 public how-to docs. - Redacted in place: README dev-only Docker+Traefik block relocated to `internal/dev-web-traefik.md` (kept the `just dev-web-local` flow); CHANGELOG internal registry host genericized; `ui-conventions.md` LC-148 audit finding-ID back-refs dropped (rationale kept); `protocol-bridges` / `email-ingress` / `desktop-update-signing` internal `LC-*` / `#PR` issue refs genericized (design rationale kept); `oidc/client.rs` dev-cert comment de-hosted. - Bonus doc-bug fix: `protocol-bridges.md` claimed the avatar-proxy 400 returns an `LC-78-AVATAR-PROXY` token in the error body. The real body names `LETS_CHAT_BRIDGE_AVATAR_PROXY_ENABLED` (verified against `routes/api.rs`); doc now matches code. ## B. Secret scan config - Pruned the dead Docker-inherited excludes (`.sops.yaml`, `*-secrets.yml`, `archived/` - none exist here) from `.trufflehog-exclude.txt`, `.noseyparker-ignore.txt`, and the kingfisher inline excludes in `check-secrets.yml`. Kept the LC-471 favicon base64 false-positive excludes. - Untracked the force-tracked `.claude/settings.local.json` (`scheduled_tasks.lock` was already untracked). - The two real dev secrets (`LETS_CHAT_SECRET_KEY`, `LETS_CHAT_BUNYIP_SSO_CLIENT_SECRET`) leave the tree with the relocated compose files. They persist in history: rotate + purge under LC-522. ## C. Compose consolidation - Kept `compose.yml` + the 3 localhost dev files (`dev-web-local`, `dev-web-local-saas`, `dev-desktop`). Relocated `compose.dev-web.yml`, `compose.dev-web-saas.yml`, and the orphan `compose.dev.yml.1` (plus the now-unused `dev/traefik-ip` helper) into `internal/`. - `justfile`: dropped the `dev-web` / `dev-web-saas` recipes (+ their `-down`/`-clean`), removed them from `dev-clean`, and added a `run` / `run-down` recipe for the production-shape `compose.yml`. ## D. Infra genericize (user-visible) - `desktop/tauri.conf.json` publisher/homepage/copyright and `server/package.json` repo URL de-hosted to placeholders; `.env.saas` commented `app.a8n.run` example URLs -> `example.com`. ## Decisions confirmed before implementing - **`desktop/src/update.rs` `DEFAULT_UPDATE_URL` left as-is.** It is read at runtime and is the functional a8n-tools update endpoint; genericizing it would silently break desktop auto-update. The README default cell is kept consistent with it. The host also remains in the CI-plumbing refs (below) that were explicitly kept. - **`.env.standalone` / `.env.saas` kept tracked** as the de-facto env reference (no `.env.example` exists), with their contradictory `.gitignore` lines removed. Content is placeholder-only. ## Verification - `just check`, `just test`, `just test-saas` all green. - `just dev-web-local` still resolves; new `just run` builds `compose.yml`. - `grep -rn 'a8n.run' $(git ls-files)` shows only the intended CI-plumbing hits (`build-oci-image.yml` REGISTRY_PROVIDER, `Dockerfile.web` image.source LABEL, `justfile` `fj --host` + release-URL rewrite) plus the deliberately-kept `LETS_CHAT_UPDATE_URL` default in README + update.rs. - Secret scanners are not installed in this environment; PR CI (`check-secrets.yml`) runs them. Commands, for reference: - `trufflehog filesystem --no-update --fail --only-verified --exclude-paths .trufflehog-exclude.txt .` - `noseyparker scan -i .noseyparker-ignore.txt . && noseyparker report` - `kingfisher scan --git-history full <favicon excludes> .` ## Notes / heads-up - Relocating `CLAUDE.md` out of the tree means Claude Code sessions on the published repo no longer auto-load it; the team keeps `internal/CLAUDE.md`. - The `internal/` dir is git-ignored, so nothing under it is in this diff; it exists on the working tree for the team. - Not operator-visible (no env var / config-format / API-contract / shipped-security change): no `[operator-action]` marker. The removed recipes are developer-workflow only; production `compose.yml` is unchanged. #LC-521

nrupard added 1 commit 2026-07-06 21:30:19 +02:00

chore(repo): publish-readiness sanitization sweep (LC-521) ... c2d8999210

Working-tree cleanup so the lets-chat repo is safe to publish publicly. History rewrite (the two dev secrets already in git history) is the separate LC-522 follow-up; this touches HEAD only. Internal material is relocated into a new git-ignored internal/ (kept for the team), not destroyed.

A. Docs relocate + redact. New git-ignored internal/ holds the relocated docs/audit/ (whole-codebase audit report), docs/superpowers/ (48 build-history plans/specs), and CLAUDE.md. FUTURE.md deleted. docs/ now keeps only the 7 public how-to docs. Redacted in place: README dev-only Docker+Traefik block relocated to internal/dev-web-traefik.md (kept the local-dev flow); CHANGELOG internal registry host genericized; ui-conventions LC-148 audit finding-ID back-refs dropped (rationale kept); protocol-bridges / email-ingress / desktop-update-signing internal LC-*/#PR issue refs genericized (design rationale kept); oidc/client.rs dev-cert comment de-hosted. Also fixed a doc bug in protocol-bridges: the avatar-proxy 400 body names LETS_CHAT_BRIDGE_AVATAR_PROXY_ENABLED, not an LC-78-AVATAR-PROXY token.

B. Secret scan config. Pruned the dead Docker-inherited excludes (.sops.yaml, *-secrets.yml, archived/ - none exist here) from .trufflehog-exclude.txt, .noseyparker-ignore.txt, and the kingfisher inline excludes in check-secrets.yml; kept the LC-471 favicon base64 false-positive excludes. Untracked the force-tracked .claude/settings.local.json (scheduled_tasks.lock was already untracked). The two real secrets (LETS_CHAT_SECRET_KEY, LETS_CHAT_BUNYIP_SSO_CLIENT_SECRET) leave the tree with the relocated compose files; they persist in history and are LC-522 + a rotation.

C. Compose consolidation. Kept compose.yml + the 3 localhost dev files (dev-web-local, dev-web-local-saas, dev-desktop). Relocated compose.dev-web.yml, compose.dev-web-saas.yml, and the orphan compose.dev.yml.1 (plus the now-unused dev/traefik-ip helper) into internal/. justfile: dropped the dev-web / dev-web-saas recipes (+ their -down/-clean) and removed them from dev-clean; added a `run` / `run-down` recipe for the production-shape compose.yml.

D. Infra genericize (user-visible). desktop/tauri.conf.json publisher/homepage/copyright and server/package.json repo URL de-hosted to placeholders; .env.saas commented app.a8n.run example URLs to example.com. Per review decisions: desktop/src/update.rs DEFAULT_UPDATE_URL left as-is (it is the functional runtime default; the README default cell is kept consistent with it), and .env.standalone / .env.saas kept tracked as the de-facto env reference with their contradictory .gitignore lines removed.

Verification: just check, just test, and just test-saas all green; just dev-web-local still resolves; grep a8n.run over tracked files shows only the intended CI-plumbing hits plus the deliberately-kept UPDATE_URL default. Secret scanners are not installed locally; PR CI (check-secrets.yml: trufflehog + noseyparker + kingfisher) runs them.

#LC-521

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nrupard added 1 commit 2026-07-06 21:36:33 +02:00

chore(ci): drop trufflehog --exclude-paths and the empty exclude file (LC-521) ... f009947c44

After pruning the dead Docker-inherited patterns, .trufflehog-exclude.txt held only comments (no real exclusions). Rather than feed trufflehog a pattern-less file, drop the --exclude-paths flag and delete the file: trufflehog runs with --only-verified so it needs no favicon exclude, and there is nothing else to exclude. noseyparker keeps its comment-only ignore file (gitignore-style, where # is a defined comment).

#LC-521

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nrupard scheduled this pull request to auto merge when all checks succeed 2026-07-06 21:38:17 +02:00

nrupard merged commit e15e58b99a into main 2026-07-06 21:44:29 +02:00

nrupard deleted branch chore/LC-521-publish-sanitization 2026-07-06 21:44:29 +02:00

nrupard referenced this pull request from a commit 2026-07-06 21:44:30 +02:00

Merge pull request 'chore(repo): publish-readiness sanitization sweep (LC-521)' (#514) from chore/LC-521-publish-sanitization into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

psa-systems/lets-chat!514

No description provided.